Vehicle CAN-Bus Timing Analysis for Masquerade Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion-detection systems in vehicle CAN-bus networks cannot effectively identify the source of malicious messages, particularly in cases of masquerade attacks, due to the absence of a MAC Address and the complexity of embedded systems.
Innovation Solution
A monitoring method that employs statistical analysis of periodic message arrival times to differentiate between nodes based on confidence intervals and voting mechanisms, allowing for the identification of the electronic control unit transmitting a message, especially during attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If statistical analysis of message arrival times is implemented to identify message sources, then the ability to detect malicious messages improves, but the device complexity increases
Solution Approach 1:
The system performs preliminary learning during a first time interval to establish statistical parameters and confidence windows for normal message arrival patterns before actual security monitoring begins. This pre-characterization of legitimate traffic patterns enables subsequent anomaly detection without requiring complex real-time analysis of message sources.
Solution Approach 2:
The patent introduces a monitoring device that acts as an intermediary between the CAN-bus nodes and the vehicle's control systems. This device captures and analyzes message traffic, using statistical methods to identify anomalies while leaving the original nodes unchanged and maintaining their existing communication protocols.
2Reliability
If time-based statistical analysis is used to differentiate nodes, then the ability to detect masquerade attacks improves, but the loss of time for message processing increases
Solution Approach 1:
The system applies statistical analysis selectively rather than to every single message. During the learning phase, it collects sufficient data to establish confidence windows, then during monitoring, it only performs anomaly checks when messages fall outside expected parameters, reducing overall processing overhead while maintaining detection reliability.
Solution Approach 2:
The patent transforms the detection approach from analyzing message content and sources to analyzing temporal parameters - specifically the arrival times of messages. By changing the detection parameter from spatial (which node sent it) to temporal (when did it arrive), the system achieves reliable attack detection with minimal processing overhead.
3Measurement precision
If confidence interval voting mechanism is implemented to identify attacker, then the precision of attacker identification improves, but the device complexity increases
Solution Approach 1:
The system segments the identification process into distinct phases: a learning phase where statistical parameters are established for each message identifier, and a monitoring phase where anomalies are detected by comparing against pre-established confidence windows. This segmentation simplifies the complexity by preparing reference data in advance rather than performing complex analysis in real-time.
Solution Approach 2:
The monitoring device creates copies of message identifiers and their associated statistical parameters during the learning phase, storing them as reference data. During monitoring, it compares incoming messages against these pre-created copies rather than performing complex source analysis, thereby achieving precise attacker identification with reduced computational complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Described herein is a method for protection from cyber attacks in a vehicle communication network (10), in particular a CAN (Controller Area Network), said network comprising: a communication bus (10), in particular a CAN-bus; a plurality of nodes (11) associated to said communication bus (10) in a signal-exchange relationship and associated at least in part to control units for controlling functions of the vehicle, said nodes (11) exchanging messages (MSG, MSG') passing between nodes of said plurality of nodes (11), said messages (MSG) being distinguished by respective message identifiers (ID), said method (100) comprising, at a control node (20) associated to said communication bus (10): executing a protection and monitoring procedure (100) comprising: a learning step (200), which is carried out during a first time interval and comprises: acquiring (210, 220, 230) sets (vIDk) of values of times of arrival (TSIDk) at the device (20) of messages (MSG) exchanged on the network (10), ordered according to a respective message identifier (IDk), computing (240) one or more statistical parameters ( µIDk, μIDk,sIDk2) of said sets of arrival-time values (TSIDk), and subsequently obtaining (250) statistical parameters (ωIDk) of confidence windows for said one or more statistical parameters ( µIDk, μIDk,sIDk2) of said sets of arrival-time values (TSIDk); and a subsequent classification and anomalydetection step (300), which is carried out during a second time interval and comprises: acquiring (310, 320, 330) sets (uIDk) of values of times of arrival (TS'IDk) at the device (20) of messages (MSG'), computing (340) corresponding one or more statistical parameters ( μ′IDk,s′IDk2) of said sets of arrival-time values (TS'IDk) to obtain votes (V, W) of membership of said one or more statistical parameters ( μ′IDk,s′IDk2) of said sets of arrival-time values (TS'IDk) in confidence windows of the sets of arrival-time values (TS'IDk) acquired during the learning step (300) on the basis of said statistical parameters (ωIDk) of confidence windows for said one or more statistical parameters ( μ′IDk,s′IDk2) of said sets of arrival-time values (TSIDk), and evaluating (350, 360) issuing of malicious-message alarms (AL) on the basis of said membership votes (V, W).